A reflected XSS in a free PHP school project nobody runs in production
CVE-2026-13554 is a reflected cross-site scripting flaw (CWE-79) in *itsourcecode Online Hotel Management System 1.0* — a free PHP/MySQL learning project distributed on itsourcecode.com and mirrored across student-tutorial sites. The unsanitized parameter lets an attacker craft a URL that, when clicked by a victim, executes attacker-controlled JavaScript in the victim's browser session. Only version 1.0 is named; the codebase has had no commercial maintenance and no semantic versioning beyond that tag.
Vendor-style MEDIUM (4.3) matches the textbook CVSS math for a reflected XSS with user interaction, but it materially overstates the real risk to any enterprise. This is throwaway tutorial code — it is not deployed on the kind of estate noisgate readers manage. The real story is fleet-relevance, not technical severity: if you own 10,000 hosts you almost certainly own zero copies of this app.
4 steps from start to impact.
Identify a running instance
- A reachable HTTP(S) instance of the app exists
- Default templates retained so fingerprinting works
- Almost no production deployments exist; this is tutorial code
- Most installations are localhost/XAMPP on a student laptop
Craft the reflected payload
<script> payloads.- Knowledge of the specific unsanitized parameter (public PoC suffices)
- Modern browsers' XSS filters and CSP defaults blunt naive payloads
- No CSP is set by this app, so payloads run — but only inside the app's origin
Deliver to a victim
- Victim is logged in to the vulnerable instance when they click
- Victim's browser executes the payload (no NoScript, no strict CSP)
- Requires social engineering with
UI:R - Email security gateways quarantine suspicious links
- Admins of toy apps are usually the developer on localhost
Steal session / pivot
- Cookies not flagged HttpOnly (this app does not set it)
- No SameSite=strict on session cookie
- Blast radius is one app instance, not the network
- No lateral movement primitive — this is a hotel booking demo, not an identity plane
reservation.php, add_room.php) and the itsourcecode footer string. If you find zero hits — which is the expected outcome — you are done. No mitigation SLA applies (LOW); document the negative finding within your normal 365-day remediation window.- EDR on the web server — XSS executes in the victim's browser, not on the server host.
- Network segmentation of the app server — does not block a URL clicked by an authenticated user from outside.
- Patching the OS / PHP runtime — the bug is in application code, not the interpreter.
The supporting signals.
| In-the-wild exploitation | None observed. No campaigns, no honeypot hits tied to this CVE. |
|---|---|
| Public PoC | Disclosure-style PoC URL in the VulDB / itsourcecode advisory; trivial to reproduce. |
| EPSS | Expected <0.1% (well under 10th percentile) — typical for itsourcecode CVEs. |
| KEV status | Not listed. No CISA KEV entry. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N — network, no privs, but requires user interaction and only low integrity impact. |
| Affected versions | itsourcecode Online Hotel Management System 1.0 (only released version). |
| Fixed versions | No vendor patch. itsourcecode does not ship security updates; project is abandonware-grade. |
| Exposure data | Shodan/Censys queries for distinctive strings return a handful (single/double digits) of demo instances globally — none on enterprise ASNs. |
| Disclosure date | 2026-06-29 (today). |
| Reporter | Independent researcher via VulDB-style coordinated entry; itsourcecode CVEs are typically batch-disclosed by student researchers. |
Sources.
Why this verdict
- Reflected XSS with UI:R — attacker needs a logged-in victim to click a crafted URL; no drive-by, no pre-auth RCE.
- Tutorial-grade software — itsourcecode projects are learning artifacts; Shodan/Censys footprint is in the low double digits worldwide, none on enterprise ASNs.
- Role multiplier: the app is canonically a *low-value role* (student demo / localhost). There is no high-value-role deployment pattern — no IdP, no hypervisor, no CA, no backup server analog. Blast radius caps at one app origin even in the worst plausible deployment, so the role-multiplier floor does not apply.
- No vendor patch pipeline — but also no enterprise consumers waiting on one; the population that needs to act is essentially empty.
- Not KEV, EPSS expected <0.1% — no active exploitation signal.
Why not higher?
MEDIUM would imply this belongs in a regular patch cycle for the average enterprise. It does not — the affected software is not in any reasonable enterprise SBOM, and the bug requires user interaction with low integrity impact only. Upgrading on technical CVSS alone ignores fleet reality.
Why not lower?
IGNORE would be wrong if you actually run this app (a tiny number of hospitality students or micro-businesses might). For those operators the bug is real and exploitable, so LOW preserves the signal that it should be tracked and removed, just not on a sprint.
Crowdsourced verification payload.
Run on each web/app host you suspect might carry the itsourcecode codebase. Invoke as sudo ./check-cve-2026-13554.sh /var/www from an auditor workstation with read access, or directly on the host as root. Requires read access to webroots.
#!/usr/bin/env bash
# check-cve-2026-13554.sh
# Detects itsourcecode Online Hotel Management System 1.0 on disk.
# Usage: sudo ./check-cve-2026-13554.sh [webroot]
# Exit: 0 PATCHED/not present, 1 VULNERABLE, 2 UNKNOWN
set -u
ROOT="${1:-/var/www}"
if [ ! -d "$ROOT" ]; then
echo "UNKNOWN: webroot $ROOT not found"
exit 2
fi
# Signature: itsourcecode footer + characteristic filenames
HITS=$(grep -rIl --include='*.php' -E 'itsourcecode|Online Hotel Management System' "$ROOT" 2>/dev/null | head -n 5)
FILES=$(find "$ROOT" -type f \( -name 'add_room.php' -o -name 'reservation.php' -o -name 'room_list.php' \) 2>/dev/null | head -n 5)
if [ -n "$HITS" ] || [ -n "$FILES" ]; then
echo "VULNERABLE: itsourcecode OHMS artifacts detected:"
echo "$HITS"
echo "$FILES"
exit 1
fi
echo "PATCHED: no itsourcecode OHMS artifacts under $ROOT"
exit 0